Remove $_SESSION usage, except install (#10745)

* Remove $_SESSION usage, except install
Fixes issue with device debug capture
Removes secure_cookies setting, use the .env variable SESSION_SECURE_COOKIE instead.  Reminder secure cookies requires cookies are transported over https, if everything is already transported via https, the setting won't make a difference.

* Fix availability map controls

app/Http/Kernel.php

@@ -38,7 +38,6 @@ class Kernel extends HttpKernel
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\VerifyCsrfToken::class,
             \App\Http\Middleware\LegacyExternalAuth::class,
-            \App\Http\Middleware\LegacySession::class,
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
         ],